Malicious code in valley-octopus-cip450-project (npm)

The package valley-octopus-cip450-project was found to contain malicious code...

MAL-2025-28136 Malicious code in octopus-everest-prx975-project (npm)

The package octopus-everest-prx975-project was found to contain malicious code...

MAL-2025-40118 Malicious code in yak-octopus-ylh814-project (npm)

The package yak-octopus-ylh814-project was found to contain malicious code...

MAL-2025-31334 Malicious code in quilt-octopus-kbt814-project (npm)

The package quilt-octopus-kbt814-project was found to contain malicious code...

MAL-2025-28135 Malicious code in octopus-dandelion-une212-project (npm)

The package octopus-dandelion-une212-project was found to contain malicious code...

Malicious code in octopus-gorge-hes657-project (npm)

The package octopus-gorge-hes657-project was found to contain malicious code...

[SECURITY] Fedora 41 Update: rust-sequoia-octopus-librnp-1.11.1-1.fc41

Reimplementation of RNP's interface using Sequoia for use with Thunderbird...

Fedora 42 : rust-sequoia-octopus-librnp (2025-51c16d6993)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-51c16d6993 advisory. Update to version 1.11.1. This version includes a fix for a potential DoS-via-zip-bomb issue. Release notes:...

Fedora 41 : rust-sequoia-octopus-librnp (2025-71b9c49854)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-71b9c49854 advisory. Update to version 1.11.1. This version includes a fix for a potential DoS-via-zip-bomb issue. Release notes:...

Fedora: Security Advisory (FEDORA-2025-51c16d6993)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-71b9c49854)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-7998

In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan...

CVE-2024-0784

A vulnerability was found in hongmaple octopus 1.0. It has been classified as critical. Affected is an unknown function of the file /system/role/list. The manipulation of the argument dataScope leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to...

CVE-2024-0890

A vulnerability was found in hongmaple octopus 1.0. It has been classified as critical. Affected is an unknown function of the file /system/dept/edit. The manipulation of the argument ancestors leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to...

CVE-2024-4456

In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page...

CVE-2024-4226

It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Octopus Server after the fixed versions listed...

CVE-2024-4811

In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts...

CVE-2024-6972

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text...

CVE-2024-0891

A vulnerability was found in hongmaple octopus 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument description with the input leads to cross site scripting. The attack can be launched remotely. The exploit has been...

CVE-2024-12226

In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was identified in Version 2 however it was determined that this could also be achieved in Version 1 and the fix was applied to both versions...